Skip to content

Commit a91d4c0

Browse files
jaikiranjaikiran
committed
8344233: Remove calls to SecurityManager and doPrivileged in java.net.ProxySelector and sun.net.spi.DefaultProxySelector after JEP 486 integration
Reviewed-by: dfuchs
1 parent d2e4b51 commit a91d4c0

File tree

4 files changed

+111
-160
lines changed

4 files changed

+111
-160
lines changed

‎src/java.base/share/classes/java/net/ProxySelector.java

-12
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@
2828
import java.io.IOException;
2929
import java.util.List;
3030

31-
import sun.security.util.SecurityConstants;
32-
3331
/**
3432
* Selects the proxy server to use, if any, when connecting to the
3533
* network resource referenced by a URL. A proxy selector is a
@@ -94,11 +92,6 @@ public ProxySelector() {}
9492
* @since 1.5
9593
*/
9694
public static ProxySelector getDefault() {
97-
@SuppressWarnings("removal")
98-
SecurityManager sm = System.getSecurityManager();
99-
if (sm != null) {
100-
sm.checkPermission(SecurityConstants.GET_PROXYSELECTOR_PERMISSION);
101-
}
10295
return theProxySelector;
10396
}
10497

@@ -114,11 +107,6 @@ public static ProxySelector getDefault() {
114107
* @since 1.5
115108
*/
116109
public static void setDefault(ProxySelector ps) {
117-
@SuppressWarnings("removal")
118-
SecurityManager sm = System.getSecurityManager();
119-
if (sm != null) {
120-
sm.checkPermission(SecurityConstants.SET_PROXYSELECTOR_PERMISSION);
121-
}
122110
theProxySelector = ps;
123111
}
124112

‎src/java.base/share/classes/sun/net/spi/DefaultProxySelector.java

+111-139
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2003, 2023, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2003, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -33,8 +33,6 @@
3333
import java.util.Collections;
3434
import java.util.List;
3535
import java.io.IOException;
36-
import java.security.AccessController;
37-
import java.security.PrivilegedAction;
3836
import java.util.Locale;
3937
import java.util.StringJoiner;
4038
import java.util.regex.Pattern;
@@ -93,26 +91,15 @@ public class DefaultProxySelector extends ProxySelector {
9391

9492
static {
9593
final String key = "java.net.useSystemProxies";
96-
@SuppressWarnings("removal")
97-
Boolean b = AccessController.doPrivileged(
98-
new PrivilegedAction<Boolean>() {
99-
public Boolean run() {
100-
return NetProperties.getBoolean(key);
101-
}});
94+
Boolean b = NetProperties.getBoolean(key);
10295
if (b != null && b.booleanValue()) {
10396
jdk.internal.loader.BootLoader.loadLibrary("net");
10497
hasSystemProxies = init();
10598
}
10699
}
107100

108-
@SuppressWarnings("removal")
109101
public static int socksProxyVersion() {
110-
return AccessController.doPrivileged(
111-
new PrivilegedAction<Integer>() {
112-
@Override public Integer run() {
113-
return NetProperties.getInteger(SOCKS_PROXY_VERSION, 5);
114-
}
115-
});
102+
return NetProperties.getInteger(SOCKS_PROXY_VERSION, 5);
116103
}
117104

118105
/**
@@ -187,148 +174,133 @@ public java.util.List<Proxy> select(URI uri) {
187174
throw new IllegalArgumentException("protocol = "+protocol+" host = "+host);
188175
}
189176

190-
NonProxyInfo pinfo = null;
177+
NonProxyInfo nonProxyInfo = null;
191178

192179
if ("http".equalsIgnoreCase(protocol)) {
193-
pinfo = NonProxyInfo.httpNonProxyInfo;
180+
nonProxyInfo = NonProxyInfo.httpNonProxyInfo;
194181
} else if ("https".equalsIgnoreCase(protocol)) {
195182
// HTTPS uses the same property as HTTP, for backward
196183
// compatibility
197-
pinfo = NonProxyInfo.httpNonProxyInfo;
184+
nonProxyInfo = NonProxyInfo.httpNonProxyInfo;
198185
} else if ("ftp".equalsIgnoreCase(protocol)) {
199-
pinfo = NonProxyInfo.ftpNonProxyInfo;
186+
nonProxyInfo = NonProxyInfo.ftpNonProxyInfo;
200187
} else if ("socket".equalsIgnoreCase(protocol)) {
201-
pinfo = NonProxyInfo.socksNonProxyInfo;
188+
nonProxyInfo = NonProxyInfo.socksNonProxyInfo;
202189
}
203-
204-
/**
205-
* Let's check the System properties for that protocol
206-
*/
207-
final String proto = protocol;
208-
final NonProxyInfo nprop = pinfo;
209190
final String urlhost = host.toLowerCase(Locale.ROOT);
210-
211-
/**
212-
* This is one big doPrivileged call, but we're trying to optimize
213-
* the code as much as possible. Since we're checking quite a few
214-
* System properties it does help having only 1 call to doPrivileged.
215-
* Be mindful what you do in here though!
216-
*/
217-
@SuppressWarnings("removal")
218-
Proxy[] proxyArray = AccessController.doPrivileged(
219-
new PrivilegedAction<Proxy[]>() {
220-
public Proxy[] run() {
221-
int i, j;
222-
String phost = null;
223-
int pport = 0;
224-
String nphosts = null;
225-
InetSocketAddress saddr = null;
226-
227-
// Then let's walk the list of protocols in our array
228-
for (i=0; i<props.length; i++) {
229-
if (props[i][0].equalsIgnoreCase(proto)) {
230-
for (j = 1; j < props[i].length; j++) {
231-
/* System.getProp() will give us an empty
232-
* String, "" for a defined but "empty"
233-
* property.
234-
*/
235-
phost = NetProperties.get(props[i][j]+"Host");
236-
if (phost != null && phost.length() != 0)
237-
break;
238-
}
239-
if (phost == null || phost.isEmpty()) {
240-
/**
241-
* No system property defined for that
242-
* protocol. Let's check System Proxy
243-
* settings (Gnome, MacOsX & Windows) if
244-
* we were instructed to.
245-
*/
246-
if (hasSystemProxies) {
247-
String sproto;
248-
if (proto.equalsIgnoreCase("socket"))
249-
sproto = "socks";
250-
else
251-
sproto = proto;
252-
return getSystemProxies(sproto, urlhost);
253-
}
254-
return null;
255-
}
256-
// If a Proxy Host is defined for that protocol
257-
// Let's get the NonProxyHosts property
258-
if (nprop != null) {
259-
nphosts = NetProperties.get(nprop.property);
260-
synchronized (nprop) {
261-
if (nphosts == null) {
262-
if (nprop.defaultVal != null) {
263-
nphosts = nprop.defaultVal;
264-
} else {
265-
nprop.hostsSource = null;
266-
nprop.pattern = null;
267-
}
268-
} else if (!nphosts.isEmpty()) {
269-
// add the required default patterns
270-
// but only if property no set. If it
271-
// is empty, leave empty.
272-
nphosts += "|" + NonProxyInfo
273-
.defStringVal;
274-
}
275-
if (nphosts != null) {
276-
if (!nphosts.equals(nprop.hostsSource)) {
277-
nprop.pattern = toPattern(nphosts);
278-
nprop.hostsSource = nphosts;
279-
}
280-
}
281-
if (shouldNotUseProxyFor(nprop.pattern, urlhost)) {
282-
return null;
283-
}
284-
}
285-
}
286-
// We got a host, let's check for port
287-
288-
pport = NetProperties.getInteger(props[i][j]+"Port", 0).intValue();
289-
if (pport == 0 && j < (props[i].length - 1)) {
290-
// Can't find a port with same prefix as Host
291-
// AND it's not a SOCKS proxy
292-
// Let's try the other prefixes for that proto
293-
for (int k = 1; k < (props[i].length - 1); k++) {
294-
if ((k != j) && (pport == 0))
295-
pport = NetProperties.getInteger(props[i][k]+"Port", 0).intValue();
296-
}
297-
}
298-
299-
// Still couldn't find a port, let's use default
300-
if (pport == 0) {
301-
if (j == (props[i].length - 1)) // SOCKS
302-
pport = defaultPort("socket");
303-
else
304-
pport = defaultPort(proto);
305-
}
306-
// We did find a proxy definition.
307-
// Let's create the address, but don't resolve it
308-
// as this will be done at connection time
309-
saddr = InetSocketAddress.createUnresolved(phost, pport);
310-
// Socks is *always* the last on the list.
311-
if (j == (props[i].length - 1)) {
312-
return new Proxy[] {SocksProxy.create(saddr, socksProxyVersion())};
313-
}
314-
return new Proxy[] {new Proxy(Proxy.Type.HTTP, saddr)};
315-
}
316-
}
317-
return null;
318-
}});
319-
320-
191+
// determine the proxies
192+
final Proxy[] proxyArray = determineProxies(urlhost, protocol, nonProxyInfo);
321193
if (proxyArray != null) {
322194
// Remove duplicate entries, while preserving order.
323195
return Stream.of(proxyArray).distinct().collect(
324196
collectingAndThen(toList(), Collections::unmodifiableList));
325197
}
326-
327198
// If no specific proxy was found, return a standard list containing
328199
// only one NO_PROXY entry.
329200
return NO_PROXY_LIST;
330201
}
331202

203+
private Proxy[] determineProxies(final String urlhost, final String protocol,
204+
final NonProxyInfo nonProxyInfo) {
205+
int i, j;
206+
String phost = null;
207+
int pport = 0;
208+
String nphosts = null;
209+
InetSocketAddress saddr = null;
210+
211+
// Then let's walk the list of protocols in our array
212+
for (i = 0; i < props.length; i++) {
213+
if (props[i][0].equalsIgnoreCase(protocol)) {
214+
for (j = 1; j < props[i].length; j++) {
215+
/* System.getProp() will give us an empty
216+
* String, "" for a defined but "empty"
217+
* property.
218+
*/
219+
phost = NetProperties.get(props[i][j] + "Host");
220+
if (phost != null && phost.length() != 0)
221+
break;
222+
}
223+
if (phost == null || phost.isEmpty()) {
224+
/**
225+
* No system property defined for that
226+
* protocol. Let's check System Proxy
227+
* settings (Gnome, MacOsX & Windows) if
228+
* we were instructed to.
229+
*/
230+
if (hasSystemProxies) {
231+
String sproto;
232+
if (protocol.equalsIgnoreCase("socket"))
233+
sproto = "socks";
234+
else
235+
sproto = protocol;
236+
return getSystemProxies(sproto, urlhost);
237+
}
238+
return null;
239+
}
240+
// If a Proxy Host is defined for that protocol
241+
// Let's get the NonProxyHosts property
242+
if (nonProxyInfo != null) {
243+
nphosts = NetProperties.get(nonProxyInfo.property);
244+
synchronized (nonProxyInfo) {
245+
if (nphosts == null) {
246+
if (nonProxyInfo.defaultVal != null) {
247+
nphosts = nonProxyInfo.defaultVal;
248+
} else {
249+
nonProxyInfo.hostsSource = null;
250+
nonProxyInfo.pattern = null;
251+
}
252+
} else if (!nphosts.isEmpty()) {
253+
// add the required default patterns
254+
// but only if property no set. If it
255+
// is empty, leave empty.
256+
nphosts += "|" + NonProxyInfo
257+
.defStringVal;
258+
}
259+
if (nphosts != null) {
260+
if (!nphosts.equals(nonProxyInfo.hostsSource)) {
261+
nonProxyInfo.pattern = toPattern(nphosts);
262+
nonProxyInfo.hostsSource = nphosts;
263+
}
264+
}
265+
if (shouldNotUseProxyFor(nonProxyInfo.pattern, urlhost)) {
266+
return null;
267+
}
268+
}
269+
}
270+
// We got a host, let's check for port
271+
272+
pport = NetProperties.getInteger(props[i][j] + "Port", 0).intValue();
273+
if (pport == 0 && j < (props[i].length - 1)) {
274+
// Can't find a port with same prefix as Host
275+
// AND it's not a SOCKS proxy
276+
// Let's try the other prefixes for that proto
277+
for (int k = 1; k < (props[i].length - 1); k++) {
278+
if ((k != j) && (pport == 0))
279+
pport = NetProperties.getInteger(props[i][k] + "Port", 0).intValue();
280+
}
281+
}
282+
283+
// Still couldn't find a port, let's use default
284+
if (pport == 0) {
285+
if (j == (props[i].length - 1)) // SOCKS
286+
pport = defaultPort("socket");
287+
else
288+
pport = defaultPort(protocol);
289+
}
290+
// We did find a proxy definition.
291+
// Let's create the address, but don't resolve it
292+
// as this will be done at connection time
293+
saddr = InetSocketAddress.createUnresolved(phost, pport);
294+
// Socks is *always* the last on the list.
295+
if (j == (props[i].length - 1)) {
296+
return new Proxy[]{SocksProxy.create(saddr, socksProxyVersion())};
297+
}
298+
return new Proxy[]{new Proxy(Proxy.Type.HTTP, saddr)};
299+
}
300+
}
301+
return null;
302+
}
303+
332304
public void connectFailed(URI uri, SocketAddress sa, IOException ioe) {
333305
if (uri == null || sa == null || ioe == null) {
334306
throw new IllegalArgumentException("Arguments can't be null.");

‎src/java.base/share/classes/sun/security/util/SecurityConstants.java

-8
Original file line numberDiff line numberDiff line change
@@ -72,14 +72,6 @@ private SecurityConstants () {
7272
public static final NetPermission SPECIFY_HANDLER_PERMISSION =
7373
new NetPermission("specifyStreamHandler");
7474

75-
// java.net.ProxySelector
76-
public static final NetPermission SET_PROXYSELECTOR_PERMISSION =
77-
new NetPermission("setProxySelector");
78-
79-
// java.net.ProxySelector
80-
public static final NetPermission GET_PROXYSELECTOR_PERMISSION =
81-
new NetPermission("getProxySelector");
82-
8375
// java.net.ServerSocket, java.net.Socket
8476
public static final NetPermission SET_SOCKETIMPL_PERMISSION =
8577
new NetPermission("setSocketImpl");

‎test/jdk/java/net/URLPermission/nstest/LookupTest.java

-1
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,6 @@ static class LookupTestPermisions {
201201
final PermissionCollection perms = new Permissions();
202202

203203
LookupTestPermisions(int port) {
204-
perms.add(new NetPermission("setProxySelector"));
205204
perms.add(new SocketPermission("localhost:1024-", "resolve,accept"));
206205
perms.add(new URLPermission("http://allowedAndFound.com:" + port + "/-", "*:*"));
207206
perms.add(new URLPermission("http://allowedButNotfound.com:" + port + "/-", "*:*"));

0 commit comments

Comments
 (0)